What are Expert Rules

Expert Rules are text-based custom rules that can protect specified resources from unauthorized access and prevent exploits from known attacks. The system administrators can configure the Expert Rules in the Exploit Prevention policy available within Threat Prevention and enforce it to the endpoints.

Note
Exploit Prevention is not supported in the ARM architecture.

Expert Rules provide additional parameters and allow much more flexibility than the custom rules you create in the Access Protection policy.

The Trellix predefined Expert Rules available in Exploit Prevention policy can be:

enabled or disabled
customized to Block and Report or Report only

You can write your own Expert Rules by understanding these Trellix proprietary syntaxes along with basic knowledge on the Tool Command Language (Tcl) programming:

Arbitrary Access Control (AAC)

Legacy McAfee Host IPS-based Expert Rules

Arbitrary Access Control (AAC) is a Trellix proprietary technology in Threat Prevention protect key resources. You can extend this protection by creating rules to protect specific files, processes, and registry items. AAC-based Expert Rules use a new syntax from the Tool Command Language (Tcl) interpreter version 7.6.

Expert Rules enforced for:

Files — Protects files from unauthorized access.
Processes — Prevent the specific programs and processes from tampering and terminating.
Registry — Protects registry keys and registry values from unauthorized access.

You can also create custom Files, Processes, and Registry rules in the Access Protection policy in Threat Prevention. But, these rules don't provide the complete functionality available with Expert Rules.

For more information about the Expert Rules commands in detail, see Learn Expert Rules commands for Files, Processes, and Registry.

These Expert Rules follow the same syntax as rules created using the Expert method in McAfee Host IPS. Endpoint Security supports these legacy class types:

Buffer Overflow — Prevents buffer overflow exploits for applications in the Application Protection list.
Illegal API Use — Prevents illegal use of the Exploit Prevention API. The Expert Rules can only extend the functionality of the Illegal API Use signatures provided by Exploit Prevention content. This rules can't see APIs that aren't already covered in an Illegal API Use signature available in content.
Services — Protects Windows Services (Windows versions 8.0 and earlier only).
You can also create custom Services rules in the Access Protection policy in Threat Prevention. But, these rules don't provide the complete functionality available with Expert Rules.

For more information about the Expert Rules commands in detail, see Learn Expert Rules to protect Buffer overflow, Illegal API use, and Services.

Note
Each Expert Rule supports only one rule engine type. You can't mix different rule engine types in the same rule. That is, you can't combine a McAfee Host IPS-based rule (for example, Illegal API Use), with AAC-based rule (for example, Files).

Expert Rule types and supported syntaxes

Endpoint Security provides two syntaxes for creating the different Expert Rule types.

Rule type	AAC-based syntax	Legacy McAfee Host IPS-based syntax
Files
Registry
Processes
Buffer Overflow
Illegal API Use
Services
Program (McAfee Host IPS only)

The new AAC Processes rule type replaces the McAfee Host IPS Program rule type, which is not supported in Endpoint Security.

Note
You can't create Network IPS Expert Rules.